What is the CVSS score of CVE-2026-33513?

CVE-2026-33513 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2026-33513?

WWBN AVideo versions up to 26.0 contain a critical vulnerability that allows unauthenticated attackers to read sensitive files and execute malicious code on affected servers.

How to fix or mitigate CVE-2026-33513?

Within 24 hours: Inventory all WWBN AVideo instances and versions; assess whether any run version 26.0 or earlier. Within 7 days: Implement WAF rules blocking suspicious locale API requests with path traversal patterns (../ sequences); restrict API endpoint access to trusted IP ranges if possible; disable the locale API endpoint if not critical to operations. Within 30 days: Evaluate upgrade to version 26.1 or later if released; if unavailable, plan migration to alternative video platform or implement network-level isolation to limit blast radius.

PHP CVE-2026-33513

EUVD-2026-14480 HIGH

Path Traversal (CWE-22)

2026-03-23 GitHub_M

Path Traversal PHP RCE

8.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 18:45 euvd

EUVD-2026-14480

Analysis Generated

Mar 23, 2026 - 18:45 vuln.today

CVE Published

Mar 23, 2026 - 18:21 nvd

HIGH 8.6

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated API endpoint (APIName=locale) concatenates user input into an include path with no canonicalization or whitelist. Path traversal is accepted, so arbitrary PHP files under the web root can be included. In our test this yielded confirmed file disclosure and code execution of existing PHP content (e.g., view/about.php), and it *can* escalate to RCE if an attacker can place or control a PHP file elsewhere in the tree. As of time of publication, no patched versions are available.

AnalysisAI

WWBN AVideo versions up to and including 26.0 contain an unauthenticated path traversal vulnerability in the locale API endpoint that allows arbitrary PHP file inclusion under the web root. Attackers can achieve confirmed file disclosure and code execution by including existing PHP files, with potential escalation to full remote code execution if they can upload or control PHP files elsewhere in the application tree. The vulnerability has a CVSS score of 8.6 and requires no authentication or user interaction to exploit, though no patch is currently available and there is no evidence of active exploitation in KEV data.

Technical ContextAI

The vulnerability affects WWBN AVideo (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), an open source video streaming platform written in PHP. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory), commonly known as path traversal. The APIName=locale endpoint concatenates unsanitized user input directly into a PHP include statement without canonicalization, whitelist validation, or path restriction. This allows attackers to use directory traversal sequences (../) to navigate the filesystem and include arbitrary PHP files within the webroot, which are then executed server-side. The vulnerability leverages PHP's include functionality, which both reads and executes the specified file, making it particularly dangerous when combined with path traversal.

RemediationAI

As of the time of publication, no patched version of WWBN AVideo is available to address this vulnerability. Organizations should immediately implement compensating controls including: disable or restrict access to the locale API endpoint (APIName=locale) at the web server or application firewall level, implement strict network-level access controls to limit AVideo exposure to trusted IP ranges only, deploy web application firewall rules to detect and block path traversal attempts in API requests, and monitor for exploitation attempts in application and web server logs. Review the vendor security advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-8fw8-q79c-fp9m for updates on patch availability. Consider temporarily taking AVideo instances offline or migrating to alternative platforms if the risk tolerance is low and compensating controls are insufficient. Ensure that file upload functionality (if present) is heavily restricted to prevent attackers from placing PHP files that could be leveraged for full RCE.